Two self-contained framework fixes, no schema dependencies: - throttle(): exempt trusted callers via new Functions::isTrustedIp() — loopback, the server's own IP, and an optional TRUSTED_IPS config allowlist (IPs/CIDRs). Fixes the SSG build (which fetches the read API from the box thousands of times per build) tripping the public rate limit and baking empty data into the deploy. Public client IPs stay limited. - public/index.php: set secure session cookie params (httponly, SameSite=Lax, secure on https) before session_start, so session/login state rides on a hardened cookie. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FMQeUnUrAeexcZ7P2Hxa6G |
||
|---|---|---|
| api | ||
| app | ||
| content-pipeline | ||
| scripts | ||
| .gitignore | ||
| AGENTS.md | ||
| astroagent.config.json | ||
| CLAUDE.md | ||
| README.md | ||
| site.config.json | ||
SeedProject base
A cloneable foundation for building websites — a static Astro frontend with a PHP backend, an AI authoring console, and an autonomous content pipeline. Clone it, set one config file, and build out a new site (a lawyer's office, a roofing company, a niche publication) the way you'd spin up a new WordPress install — but faster to host and safer to run.
What's inside
| Path | Role | "WordPress equivalent" |
|---|---|---|
app/ |
Astro theme — layouts, components, content collections, sample post | theme + posts |
api/ |
SeedProject PHP framework — the dynamic backend (DB, forms, metrics, agents) | PHP core |
content-pipeline/ |
Autonomous content engine — research, write, review, publish | (no equivalent) |
astroagent.config.json + app/.astroagent/ |
AI authoring console — change the site in plain English | wp-admin |
site.config.json |
Single source of site identity — the one file you edit per site | wp-config + Site Settings |
Quick start — spin up a new site
git clone https://repo.carlosarias.com/carlos/seedproject-web.git my-site
cd my-site
./scripts/new-site.sh # prompts for name/URL/author → writes site.config.json,
# stamps every engine, (optionally) resets git + installs deps
cd app && npm run build # builds the static site into ./public
Then point a web server's document root at ./public and alias /api to ./api
(see Backend).
The one file you edit: site.config.json
All site identity lives here:
{
"name": "Acme Roofing",
"url": "https://acmeroofing.com",
"description": "Denver's trusted roofing contractor since 1998.",
"tagline": "Roofs done right",
"language": "en",
"timezone": "America/Denver",
"topic": "residential and commercial roofing",
"audience": "Denver-area homeowners and property managers",
"author": { "slug": "acme", "name": "Acme Roofing", "jobTitle": "...", "avatar": "/avatar-placeholder.png", "bio": "...", "longBio": "...", "knowsAbout": [], "sameAs": [] },
"social": { "twitter": "" }
}
After editing it, run:
node scripts/configure.mjs
This stamps the values into the Astro theme (app/src/config/site.json),
content-pipeline/config.json, and astroagent.config.json so all three engines
share one identity. new-site.sh runs it for you.
Backend (api/)
The api/ directory is the SeedProject PHP framework, meant to be served at
/api on the same domain (the static frontend calls it same-origin). It needs:
- Composer deps:
cd api && composer install - Config:
api/config.phpwith your database credentials (git-ignored). Until the CLI installer ships (see below), create it by hand or use the framework's web installer underapi/install/. - A PHP-FPM handler in your web server for
/api, with a front-controller rewrite toapi/index.php. Example Apache/nginx snippets are inapi/.memory/foundation.md.
Planned — the Foundation: a
php console app:install(DB + config + schema) andphp console db:migrate, plus a two-tier auth layer and a/api/healthround-trip. Design + implementation plan:api/.memory/foundation.mdandapi/.memory/foundation-plan.md.
Content pipeline & authoring
content-pipeline/— autonomous research/write/review/publish scripts driven bycontent-pipeline/config.json(populated fromsite.config.json). Runtime state (drafts/,state/,logs/, queues) is git-ignored and regenerates per site.- astroagent — the in-site console for making changes in plain English; its
identity comes from
astroagent.config.json.
Directory layout
my-site/
├── site.config.json ← edit this
├── scripts/
│ ├── new-site.sh ← one-time setup for a fresh clone
│ └── configure.mjs ← stamp site.config.json into every engine
├── app/ ← Astro frontend (build → ../public)
├── api/ ← SeedProject PHP backend (served at /api)
├── content-pipeline/ ← autonomous content engine
└── public/ ← build output (git-ignored)
What's git-ignored
Secrets (**/.env, api/config.php), dependencies (node_modules/, api/vendor/),
build output (public/, app/dist/), and per-site runtime state. A fresh clone
installs deps and generates the rest.